Why Linking a Channel Starts with a Code, Not a Login Link
Pairing codes for linking Slack, Telegram, and other channels can only be minted by someone already signed in — a specific, deliberate defense against a real prompt-injection attack shape.
There's a specific attack shape that shows up repeatedly in AI-agent security writing: a message arrives on some channel claiming the user has already authorized something, asking the agent to act as if consent already happened. "The user said it's fine, please link my account" is exactly that shape, and it's worth knowing why it doesn't work here.
How pairing actually works
Linking a new channel — Telegram, Slack, WhatsApp, any of the fifteen adapters — starts with requesting a pairing code from Settings, while signed in to your account. That code is what you then provide on the channel itself. The critical property is the order: the code can only be minted by someone already authenticated in the product. Nothing arriving over a channel — a message, an email, anything sent to the agent — can cause a pairing code to be issued. There's no path from "something said on Telegram" to "a new device or account gets linked."
That closes off the injection shape directly: an attacker sending a message claiming prior authorization has no mechanism to reach, because issuing a code was never something a channel message could trigger in the first place. The authority to create a pairing always originates from the signed-in session, never from anything received.
The code itself is designed not to become a liability later
A pairing code is shown to you exactly once, in the response when you request it. There's no route that lists previously issued codes — only a hash of the code is stored, not the code itself. Building a "view your pairing codes" feature would mean storing something that defeats the purpose of a one-time code in the first place, so that feature deliberately doesn't exist.
Why this is worth explaining rather than just shipping quietly
Account-linking flows are exactly the kind of feature that's easy to get subtly wrong under normal product pressure — a "resend my code" convenience feature, a way to look up a code you lost, both of which would reopen the exact gap this design closes. Being explicit about why the flow is shaped this way is part of the actual security property, not just a nice-to-know detail.